Nigeria's Jan. 1 payment-data deadline: what it means for Canadian vendors

By the Citi Sighs Intelligence Desk — Toronto, October 24, 2026

TORONTO — Nigeria's central bank says the date will not move. From January 1, 2027, payment transaction data generated in Nigeria must be stored and managed in Nigeria, under a Central Bank of Nigeria (CBN) circular issued on June 15. That is 69 days away, and the CBN told a Lagos industry roundtable this month that there is no extension.

For a Canadian fintech, payments or software firm serving Nigerian banks, merchants or consumers, the question is whether the rule reaches them, directly or through clients. Two common assumptions — that it is only a bank problem, and that a local backup will do — do not match how Nigerian lawyers read it.

What the rule says

The circular, reference PSS/DIR/PUB/CIR/001/004, was signed by Rakiya O. Yusuf, director of the CBN's Payments System Supervision Department, Nairametrics reported, and the reference matches Aluko & Oyebode's alert. It is addressed to banks, microfinance banks, mobile money operators, switches, payment terminal and solution providers, super agents and other licensed operators, ThisDay reported.

The localisation clause covers all financial institutions and participants facilitating payments within Nigeria. It requires that transaction data generated in the country be kept and managed there, in line with Nigerian data protection law, with full compliance from January 1, 2027, according to the circular's text.

The circular also caps market share: an institution with more than 25% of card issuing over a rolling 12 months may hold no more than 15% of merchant acquiring, and the reverse, with compliance due by December 31, 2026; ThisDay reported the caps also count related group entities. It requires disclosure of significant shareholders' ultimate owners too. The CBN says it will monitor compliance and may impose supervisory sanctions, without listing specific penalties, according to the circular's text.

Four things founders get wrong

• "We are not a bank, so it does not apply." The trigger is where the data is generated, not where the firm is incorporated, in the reading of lawyers at Pavestones Legal. Even a firm outside the circular's direct reach is likely to meet it through contracts: regulated Nigerian clients stay responsible for data they outsource, and the same lawyers advise that vendor contracts address localisation, audit rights and exit terms.
• "A local copy is enough." The word "managed" matters. Pavestones reads it to cover processing, databases, backups and operational control, so offshore backup or disaster recovery for payment data may not comply, and offshore admin access may also be caught. At the Lagos roundtable, the CBN said compliance must address the whole life of the data, from creation to disposal, ThisDay reported.
• "We already comply with Nigeria's data protection law." The circular adds to the Nigeria Data Protection Act; it does not replace it. The Act governs transfers of personal data through recognised mechanisms, while the CBN rule is a separate obligation on payment data, so meeting the Act alone will not satisfy the circular, according to Pavestones.
• "There will be an extension." Ms. Yusuf, in remarks delivered by Assistant Director Babatunde Ajiboye, said the compliance date has not changed. The CBN also disclosed that it hosts some of its own payment data abroad and has begun moving it home, and said it will start reviewing compliance after January 1, ThisDay reported.

How Canada's rules differ

Canada's federal private-sector privacy law works differently. Under PIPEDA, a company may send personal information to another country for processing; it stays accountable, must use contracts to secure comparable protection and should tell customers their data may be processed abroad, the Office of the Privacy Commissioner says. Some provinces have their own rules, but the federal baseline does not require data to stay in Canada.

Who is ready

Most tier-1 and tier-2 Nigerian commercial banks have already localised, while fintechs and digital banks still hosting abroad are the main gap, Krishnan Ranganath, chief executive of cloud provider UniCloud Africa, told BusinessDay. His firm stands to gain from migrations. He said long-term global cloud contracts make moving costly, and that Nigerian data centres can handle the demand.

Nigerian operators say they are ready. MTN Nigeria cited 12 data centres, and Open Access Data Centres, Nobus Cloud and Layer3 described local capacity, ThisDay reported. The same report said some fintechs plan to move only a small share of their data and keep most of it offshore, and that some fear data loss during migration. Officials frame the rule as data sovereignty. In remarks delivered by Ibukunoluwa Owa, the Nigeria Data Protection Commission's chief executive, Vincent Olatunji, said Africa accounts for about 0.5% of global data centres, ThisDay reported.

What to watch next

• December 31, 2026: market-share caps take full effect.
• January 1, 2027: the localisation deadline. CBN compliance reviews follow.
• CBN guidance defining "payment transaction data" or "managed"; Pavestones said in July none had been issued.

The case for and against

For: in our view, the rule gives Nigeria's regulator direct reach over critical financial records and creates demand for Nigerian data centres, cloud firms and local fintechs already hosting onshore. For a Canadian vendor, a compliant Nigerian setup could be a selling point to banks that must check their suppliers.

Against: the scope is undefined, many in the industry privately see the roughly six-month window as very ambitious, BusinessDay reported, and we think migration costs and transition risk will fall hardest on smaller fintechs, Nigerian and foreign, and could reach merchants and consumers through fees or service disruption.

What we could not verify

• We could not open the CBN's PDF directly through our tools. We relied on a reproduction of its text and on consistent reports from Nigerian press and law firms.
• The circular does not define "payment transaction data" or "managed", and we found no CBN guidance that does.
• Whether foreign platforms without a CBN licence are directly bound, rather than bound through their Nigerian clients' contracts.
• Whether Ghana has, or plans, a comparable rule: we found no official Ghanaian source confirming one.

Disclosure: Citi Sighs has no commercial relationship with any company or institution named in this article. This article is general information, not tax, legal or investment advice.